CVE-2026-42506

creationtimestamp| type| source ---|---|--- 2026-05-22 16:35:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmhej6i35b2c 2026-06-30 01:29:32+00:00| seen| https://gist.github.com/illoyd/2131d93f5933897a469738feaf75a3e9...

CVE-2026-0211

creationtimestamp| type| source ---|---|--- 2026-05-22 16:00:05+00:00| seen| https://t.me/GithubRedTeam/85414 2026-05-22 19:00:10+00:00| seen| Telegram/GxW7z8duNlVdfiWWsv41lYfs7S7xkZAHymlGuRAZQODzxg...

MAL-2026-4627 Malicious code in onboardconnect-agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9c17efe362ab4daf81f1ee7efe462a256ba325562a255906102d10d4a9ee87e5 The package's dist/setup.js script performs an HTTPS POST to https://oc-worker-tenant-api.wpolanco.workers.dev carrying values read from process.env,...

CVE-2026-30496

creationtimestamp| type| source ---|---|--- 2026-05-22 13:33:11+00:00| seen| https://bsky.app/profile/keiwork35.bsky.social/post/3mmh2cymjew2e...

CVE-2026-9277

creationtimestamp| type| source ---|---|--- 2026-05-22 13:22:55+00:00| published-proof-of-concept| https://github.com/ljharb/shell-quote/security/advisories/GHSA-w7jw-789q-3m8p 2026-05-22 17:34:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmhhsrhmds2o 2026-05-23 05:06:18+00:00...

OESA-2026-2390 python-urllib3 security update

HTTP library with thread-safe connection pooling, file post support, sanity friendly, and more. Security Fixes: urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via ProxyManager.connectionfromurl.urlopen...,...

OESA-2026-2385 trafficserver security update

Apache Traffic Server is an OpenSource HTTP / HTTPS / HTTP/2 / QUIC reverse, forward and transparent proxy and cache. Security Fixes: A bug in POST request handling causes a crash under a certain condition. This issue affects Apache Traffic Server: from 10.0.0 through 10.1.1, from 9.0.0 through...

OESA-2026-2384 trafficserver security update

Apache Traffic Server is an OpenSource HTTP / HTTPS / HTTP/2 / QUIC reverse, forward and transparent proxy and cache. Security Fixes: A bug in POST request handling causes a crash under a certain condition. This issue affects Apache Traffic Server: from 10.0.0 through 10.1.1, from 9.0.0 through...

OESA-2026-2383 trafficserver security update

Apache Traffic Server is an OpenSource HTTP / HTTPS / HTTP/2 / QUIC reverse, forward and transparent proxy and cache. Security Fixes: A bug in POST request handling causes a crash under a certain condition. This issue affects Apache Traffic Server: from 10.0.0 through 10.1.1, from 9.0.0 through...

CVE-2026-43490

creationtimestamp| type| source ---|---|--- 2026-05-22 13:05:30+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mmgyri3mmq2x...

CVE-2026-43088

creationtimestamp| type| source ---|---|--- 2026-05-22 13:05:30+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mmgyri3mmq2x 2026-05-31 20:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities20260601...

CVE-2026-7798

creationtimestamp| type| source ---|---|--- 2026-05-22 13:02:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmgylmkdyf2e...

CVE-2026-5072

creationtimestamp| type| source ---|---|--- 2026-05-22 10:18:43+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmgphbdra32p...

CVE-2026-7615

The Widget Context plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.3. This is due to missing or incorrect nonce validation on the savewidgetcontextsettings function. This makes it possible for unauthenticated attackers to modify widget...

Malicious code in @pisell/pisellos (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e11b6f8e400f4de371e79ce547444daf3787d6217037ea2e8d05c8ba86cbfbb2 The package advertises itself as a point-of-sale / venue-booking SDK, but its ScanOrderImpl and VenueBookingImpl solution classes register a default...

EUVD-2026-31415

The Widget Context plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.3. This is due to missing or incorrect nonce validation on the savewidgetcontextsettings function. This makes it possible for unauthenticated attackers to modify widget...

CVE-2026-7615

The CVE-2026-7615 entry concerns the WordPress Widget Context plugin (versions ≤ 1.3.3). Vulnerability: Cross-Site Request Forgery due to missing or incorrect nonce validation in save_widget_context_settings, allowing unauthenticated attackers to modify widget visibility context settings stored i...

MAL-2026-4387 Malicious code in @euqns/nudge-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b1e494fee8148b95f98e5de04cc4ecd78ed793ff2d019ae672e2b22d2debc3b The package ships dist/setup.js which performs HTTP POST requests at install time to a hardcoded external endpoint at...

CVE-2026-6864

creationtimestamp| type| source ---|---|--- 2026-05-22 07:13:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmgf3hprox2k 2026-05-25 05:49:15+00:00| seen| https://bsky.app/profile/donwebmedia.bsky.social/post/3mmnrs6gp4q2l...

CVE-2026-7509

creationtimestamp| type| source ---|---|--- 2026-05-22 06:58:09+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmgeamfjm22k 2026-05-25 04:25:55+00:00| seen| https://bsky.app/profile/donwebmedia.bsky.social/post/3mmnn56cp2o2s...